API

API keys & authentication

Two kinds of key, one rule: publishable keys go in clients, secret keys stay on servers.

Key types

Key	Used from	Access
`pk_live_…`	Browsers, mobile apps	Ingest only — `track` and `identify`
`sk_live_…`	Servers, CI, scripts	Full API — ingest, query, export, admin

Find your keys

lists every key in the workspace with its last-used time. Secret keys are shown once at creation — copy them then, or create a new one.

Environment variables

Read secret keys from the environment. The server SDKs default to ALITYCS_SECRET_KEY when no key is passed.

# .env — keep secret keys out of source control
ALITYCS_SECRET_KEY=sk_live_9mQ4vXr7
ALITYCS_PUBLISHABLE_KEY=pk_live_4Kd9xTz2
ALITYCS_WORKSPACE_ID=ws_01HQ8Y3M2J7K9P4T6V0X

Rotate a key

Create the replacement

Both keys work in parallel; there's no limit of one per type.

Deploy it everywhere

Watch the old key's last-used time fall to zero.

Revoke the old key

Use the key's menu on the API keys page.